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DETAILED ACTION 

1 . The following is a Final office action in response to communications received 
03/02/2007. Claims 3, 6, 17, and 24 have been amended. Claims 25-26 have been 
added. Claims 1-6, 9-17, and 20-26 are pending. 

Response to Amendment 

2. Applicant's amendment to claims 6 and 17 are sufficient to overcome the 35 USC 
§ 1 12, second paragraph, rejections set forth in the previous office action. 

Claim Objections 

3. Claim 26 is objected to because of the following informalities: misnumbering. 
New claim 26 is currently labeled claim 21, which would be.a duplicate of the previously 
pending claim 21 . This claim is therefore construed as claim 26. Appropriate correction 
is required. 

Allowable Subject Matter 

4. Claim 21 is objected to as being dependent upon a rejected base claim, but would 
be allowable if rewritten in independent form including all of the limitations of the base 
claim and any intervening claims. 

Claim Rejections - 35 USC §102 

5. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 
form the basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), by 
another filed in the United States before the invention by the applicant for patent or (2) a patent granted 
on an application for patent by another filed in the United States before the invention by the applicant 
for patent, except that an international application filed under the treaty defined in section 351(a) shall 
have the effects for purposes of this subsection of an application filed in the United States only if the 
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international application designated the United States and was published under Article 21(2) of such 
treaty in the English language. 

6. Claims 1-6, 9-17, 20, 22, and 25-26 are rejected under 35 U.S.C. 102(e) as being 
anticipated by Barton et al. (U.S. 2002/0059093). 

As per claim 1, Barton et al. teaches a method for use in compliance management, 
comprising: 

presenting, via a computer network, at least one user with a series of questions 
relating to at least one business category (See figure 1 1 , paragraphs 0010, 0012-4, 0049, 
0051, wherein questions are presented via the network concerning compliance risk); 

soUciting, via the computer network, a response from the at least one user for each 
question presented (See paragraphs 0010, 0012-4, 0049, 0051, 0060, wherein the 
questions are answered); 

determining a detection index based on the number of responses to each of the 
series of questions (See paragraphs 0081 and 0084, wherein detection is determined); 

determining an occurrence index based on the potential consequence of non- 
compUance (See paragraphs 0007, 0081, and 0084, wherein occurrence index is 
determined); 

determining a standard severity risk index based on the expected severity of non- 
compliance (See paragraphs 0068, 0072-3, 0075, 0081, 0084, wherein severity indexes 
are considered); and 

prioritizing, via the computer network, the at least one business category based on 
the at least one user's responses and at least one total risk score comprising the product of 
the detection, occurrence, and standard severity risk indices (See paragraphs 0081, 0084- 

7, wherein a risk score is calculated based on these factors. See also paragraphs 0068-9, 
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0072, 0081, 0090-1, where risk prioritization numbers are generated to determine the 
order to handle the risk areas of the business). 

As per claim 2, Barton et al. discloses wherein the user response comprises a 
"Yes" or "No" (See paragraphs 0060 and 0064, wherein the questions are answered 
yes/no). 

As per claim 3, Barton et al. discloses wherein the at least one standard severity 
risk index comprises a number between 1 and 10 corresponding to a specific level of risk 
(See paragraph 0060, 0068, 0072-5, wherein severity is valued 1-10). 

As per claim 4, Barton et al. discloses wherein the number "1" comprises the 
lowest level of risk severity, and the number "10" the highest level of severity (See 
paragraph 0060, 0068, 0072-5, wherein 1 is low and 10 is high severity). 

As per claim 5, Barton et al. teaches wherein the at least one standard severity risk 
index corresponds to the at least one business category (See paragraph 0040, 0060, 0068, 
0072-5, which corresponds to at least one business category. See also figure 1 1). 

As per claim 6, Barton et al. discloses the step of determining a detection index 
based on the at least one user's responses, and the number of users (See paragraphs 0065 
and 0084, wherein the detection index is determined based on the responses fi-om the at 
least one user). Barton et al. also generates a score based on the number of questions 
presented (i.e. "opps") (See paragraphs 0065 and 0084, where the number of questions 
presented (ie opportunities) are used to determine a score). 

As per claim 9, Barton et al. teaches ranking the at least one business category 
based on the at least one total risk score (See paragraphs 0081, 0084-7, wherein a risk 
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score is calculated See also paragraphs 0068-9, 0072-5, 0081, 0090-1, where risk is 
prioritized). 

As per claim 10, Barton et al teaches a system for use in compliance 
management, comprising: 

a query module associated with an engine for presenting at least one user with a 
series of questions relating to at least one business category, and for soliciting and 
receiving responses from the at least one user for each question presented (See figure 1 1, 
paragraphs 0010, 0012-4, 0049, 0051, 0060, wherein questions are presented via the 
network concerning compliance risk and answers are received);; 

a prioritization module associated with the engine for: (1) determining a detection 
index based on the number of responses to each of the series of questions, determining an 
occurrence index based on the potential consequence of non-compliance, and 
determining a standard severity risk index based on the expected severity of non- 
compliances (See paragraphs 0068, 0072-3, 0075, 0081, 0084, wherein a detection, 
occurrence, and severity index are determined) and (2) prioritizing the at least one 
business category based on the at least one user's responses arid at least one total risk 
score comprising the product of a detection, occurrence and standard severity risk indices 
(See paragraphs 0081, 0084-7, wherein a risk score is calculated based on these factors. 
See also paragraphs 0068-9, 0072, 0081, 0090-1, where risk prioritization numbers are 
generated to determine the order to handle the risk areas of the business). 

As per claim 1 1, Barton et al. teaches wherein the series of questions are 
presented to the user over a communications network (See figure 1 1, paragraphs 0010, 
0012-4, 0049, 0051, 0060, wherein questions are presented via the network). 
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As per claim 12, Barton et al. teaches wherein an administration module 
associated with the engine for inputting, updating and accessing data associated with the 
query and prioritization modules, the administration module being accessible to an 
administrator of the system via an administration interface (See paragraphs 0012-3, 0048- 
51, 0060, 0064, wherein an administrator and interface is disclosed). 

Claims 13-17 and 20 recite equivalent limitations to claims 2-6 and 9, 
respectively, and are therefore rejected using the same art and rationale as apphed above. 

As per claim 22, Barton et al. teaches wherein the occurrence index weighs the 
total risk score based on the potential consequences of non-compliance (See paragraphs 
0081, 0084-7, wherein a risk score is calculated based on these factors, and wherein 
occurrence influences and affects the overall score. See also paragraphs 0072 and 0075). 

As per claim 25, claim 25 is rejected using the same art and rationale set forth 
above with respect to claim 21. Barton et al. further discloses assessing a potential 
consequence of non-compliance, the potential consequence of non-compliance relating to 
parameters and the values of such parameters (See figure 16 and paragraphs 7, 38, 42, 44, 
55, that disclose potential consequences (failure effects) of failures of non-compliance); 
determining an occurrence index based on the potential consequence of non-compliance 
that was assessed, such that the occurrence index changes as the parameters associated 
with the potential consequence of non-compliance change, the occurrence index that is 
determined being one of at least three possible occurrence indices, the at least three 
possible occurrence indices being provided as possible occurrence indices (See figure 16 
and paragraphs 81 and 84, which disclose an occurrence index that results fi:om the 
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identified potential failures and the failure's effects. The occurrence index can be chosen 
from a set of 1-10). 

As per claim 26, Barton et al. teaches wherein the detection index by a 
relationship between the number of queries or questions that were answered with a 
particular response, the total number of queries or questions in the category, and the . 
number of departments or units responding (See paragraphs 0010, 0012-4, 0049, 0051, 
0060, wherein the questions are answered. Paragraphs 56-9, 62, 72, and 90, specifically 
discuss the gathering of information from interviews and questionnaires into the 
knowledge base of the system. This knowledge base is relied upon to determine the 
detection index. See specifically paragraphs 0081 and 0084, wherein detection is 
determined using the knowledge base). 

Claim Rejections - 35 USC § 103 

7. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

8. Claims 23-24 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Barton et al. (U.S. 2002/0059093). 

As per claims 23 and 24, Barton et al. teaches wherein an occurrence index and 
where the occurrence index represents the likelihood of occurrence and the frequency of 
non-compliance (See paragraphs 0081 and 0084-6). However, Barton et al. does not 
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expressly disclose that the occurrence index is based on the total number of agents or 
employees affected by non-compUance or the total number of policies in force. 

Barton et al. teaches an occurrence value that is indicated in the system and 
represents the likelihood of occurrence and the frequency of non-compliance. It is old 
and well known in the art that employees and the number of policies are factors that 
cause occurrences of non-compUance, such as a regulation being violated by a policy or 
an employee not following a rule. Therefore, it would have been obvious to one of 
oprdinary skill in the art at the time of the invention to consider employees affected by 
non-compliance and the total number of policies in force in the occurrence index of 
Barton et al. in order to more efficiently determine the potential for failure conceming the 
business by taking into accoxmt the areas in which non-compliance events may occur. 
See paragraphs 0065 and 0084. 

Response to Arguments 
9. Applicant's arguments with regards to Barton et al. (U.S. 2002/0059093) have 
been fully considered, but they are not persuasive. In the remarks, Applicant argues that 
(1) Barton et al. does not teach or suggest "determining an occurrence index based on the 
potential consequence of noncompliance" and that the occurrence factor of Barton is 
concerned with whether a non-compliance is likely to occur (i.e. likelihood) instead of 
the potential consequence and (2) that examiner has not established a prima facie case of 
obviousness with regards to claims 23-24, since Barton et al. does not expressly disclose 
determining an occurrence index based on the potential consequence of noncompliance 
and that the modification presented by Examiner, even if obvious, would still fail to 
address the deficiencies of Barton et al. 
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In response to argument (1), Examiner respectfully disagrees. Barton et al. 
teaches "determining an occurrence index based on the potential consequence of 
noncompHance" as shown in at least paragraphs 81 and 84. Barton et al identifies 
potential failure modes and root causes of these failures in order to quantify compUance 
issues, assess potential risks, and mitigate and control risks. The term failure, within the 
context of Barton et al, is compUance failure and includes the causes and effects of 
failure. See at least paragraphs 7, 38, and 42. An FMEA matrix is constructed that 

- i 

includes a likeUhood of occurrence factor, and using the rating system to calculate 
numbers using this occurrence factor, the numbers used to rank risks of noncompliance 
and recommend actions to reduce the risks. All of these calculations are based on the 
fact that failxires occur. 

In temis of the scope of the claim language, the claim recites, "determining an 
occurrence index based on the potential consequence of noncompliance", and thus the 
claim does not recite a specific manner in which the index is determined, but merely that 
it is based (i.e. being founded or established) on the potential consequences (or potential 
effect, result, or outcome) of noncompliance. Therefore, the recitation of "potential 
consequences of noncompliance" requires that the determined index considers the fact 
that consequences of non-compliance occur. Examiner further points out that in the 
broadest reasonable interpretation of the claim, the term "determining" would mean 
deciding on, discovering, or finding out. The claim does not require the use of a specific 
algorithm or method within the scope of the claim language. Thus, the language 
"determining an occurrence index" merely requires setting a value in the system that 
reflects the value of the index based on received answers to questions. Without any 
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recitation of how this is decided on, it could merely occur via solicitation of a value from 
a single user, in the broadest reasonable interpretation of the claim, since claim 1 only 
requires soliciting a response from at least one user for each question. Therefore, the 
occurrence index would be determined based on one user's responses to a series of 
questions. Therefore, if something more specific is meant by this Umitation, examiner 
respectfully recommends amending the limitation so that it can receive proper patentable 
weight. 

In response to argument (2), Examiner respectfiiUy disagrees. Examiner has 
established a prima facie case of obviousness because Barton et al. does teach and 
suggest "determining an occurrence index based on the potential consequence of 
noncompliance", as explained above with respect to argument (1). 

Conclusion 

Applicant's amendment necessitated the new ground(s) of rejection presented in 
this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP 
§ 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 
CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the 
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advisory action. In no event, however, will the statutory period for reply expire later than 
SIX MONTHS from the date of this final action. 

The prior art made of record and not relied upon is considered pertinent to 
apphcant's disclosure. 

Spielmann et al. (U.S. 7,113,914) discloses a risk management system that rates 
the risks associated with non-compliance. 

Packwood (U.S. 7,006,992) teaches quantifiable risk factors associated with a 
business, with immediacy and tolerance factors, and evaluating the values associated with 
the risk. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Beth Van Doren whose telephone number is 571-272- 
6737. The examiner can normally be reached on M-F, 8:00-5:00. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Tariq Hafiz can be reached on 571-272-6729. The fax phone number for the 
organization where this application or proceeding is assigned is 57 1 -273-8300. 
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Information regarding the status of an application may be obtained from the 



Patent AppUcation Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or PubUc PAIR. Status 
information for unpubUshed applications is available through Private PAIR only. For 
more information about the PAIR system, see http://pair-direct.uspto.gov. Should you 
have questions on access to the Private PAIR system, contact the Electronic Busiuess 
Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO 
Customer Service Representative or access to the automated information system, call 
800-786-9199 (IN USA OR CANADA) or 571-272-1000. 
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